Ubuntu 23.10 USN-6578-1 moderate: dotnet X.509 issues and DoS

ubuntu

January 11, 2024

Several security issues were fixed in dotnet6, dotnet7, and dotnet8.

Summary

Several security issues were fixed in dotnet6, dotnet7, and dotnet8.

Software Description:

- dotnet6: dotNET CLI tools and runtime

- dotnet7: dotNET CLI tools and runtime

- dotnet8: dotNET CLI tools and runtime

Details:

Vishal Mishra and Anita Gaud discovered that .NET did not properly

validate X.509 certificates with malformed signatures. An attacker

could possibly use this issue to bypass an application's typical

authentication logic. (CVE-2024-0057)

Morgan Brown discovered that .NET did not properly handle requests from

unauthenticated clients. An attacker could possibly use this issue to

cause a denial of service. (CVE-2024-21319)

Topics Covered

security advisory denial of service Ubuntu X.509 certificate dotnet malformed signature

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   aspnetcore-runtime-6.0          6.0.126-0ubuntu1~23.10.1
   aspnetcore-runtime-7.0          7.0.115-0ubuntu1~23.10.1
   aspnetcore-runtime-8.0          8.0.1-0ubuntu1~23.10.1
   dotnet-host                     6.0.126-0ubuntu1~23.10.1
   dotnet-host-7.0                 7.0.115-0ubuntu1~23.10.1
   dotnet-host-8.0                 8.0.1-0ubuntu1~23.10.1
   dotnet-hostfxr-6.0              6.0.126-0ubuntu1~23.10.1
   dotnet-hostfxr-7.0              7.0.115-0ubuntu1~23.10.1
   dotnet-hostfxr-8.0              8.0.1-0ubuntu1~23.10.1
   dotnet-runtime-6.0              6.0.126-0ubuntu1~23.10.1
   dotnet-runtime-7.0              7.0.115-0ubuntu1~23.10.1
   dotnet-runtime-8.0              8.0.1-0ubuntu1~23.10.1
   dotnet-sdk-6.0                  6.0.126-0ubuntu1~23.10.1
   dotnet-sdk-7.0                  7.0.115-0ubuntu1~23.10.1
   dotnet-sdk-8.0                  8.0.101-0ubuntu1~23.10.1
   dotnet6                         6.0.126-0ubuntu1~23.10.1
   dotnet7                         7.0.115-0ubuntu1~23.10.1
   dotnet8                         8.0.101-8.0.1-0ubuntu1~23.10.1

Ubuntu 23.04:
   aspnetcore-runtime-6.0          6.0.126-0ubuntu1~23.04.1
   aspnetcore-runtime-7.0          7.0.115-0ubuntu1~23.04.1
   dotnet-host                     6.0.126-0ubuntu1~23.04.1
   dotnet-host-7.0                 7.0.115-0ubuntu1~23.04.1
   dotnet-hostfxr-6.0              6.0.126-0ubuntu1~23.04.1
   dotnet-hostfxr-7.0              7.0.115-0ubuntu1~23.04.1
   dotnet-runtime-6.0              6.0.126-0ubuntu1~23.04.1
   dotnet-runtime-7.0              7.0.115-0ubuntu1~23.04.1
   dotnet-sdk-6.0                  6.0.126-0ubuntu1~23.04.1
   dotnet-sdk-7.0                  7.0.115-0ubuntu1~23.04.1
   dotnet6                         6.0.126-0ubuntu1~23.04.1
   dotnet7                         7.0.115-0ubuntu1~23.04.1

Ubuntu 22.04 LTS:
   aspnetcore-runtime-6.0          6.0.126-0ubuntu1~22.04.1
   aspnetcore-runtime-7.0          7.0.115-0ubuntu1~22.04.1
   dotnet-host                     6.0.126-0ubuntu1~22.04.1
   dotnet-host-7.0                 7.0.115-0ubuntu1~22.04.1
   dotnet-hostfxr-6.0              6.0.126-0ubuntu1~22.04.1
   dotnet-hostfxr-7.0              7.0.115-0ubuntu1~22.04.1
   dotnet-runtime-6.0              6.0.126-0ubuntu1~22.04.1
   dotnet-runtime-7.0              7.0.115-0ubuntu1~22.04.1
   dotnet-sdk-6.0                  6.0.126-0ubuntu1~22.04.1
   dotnet-sdk-7.0                  7.0.115-0ubuntu1~22.04.1
   dotnet6                         6.0.126-0ubuntu1~22.04.1
   dotnet7                         7.0.115-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.